CVS log for src/usr.bin/ssh/monitor.c

Up to [OpenBSD] / src / usr.bin / ssh

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

ECDH/ECDSA compliance fix: these methods vary the hash function they use
(SHA256/384/512) depending on the length of the curve in use. The previous
code incorrectly used SHA256 in all cases.

This fix will cause authentication failure when using 384 or 521-bit curve
keys if one peer hasn't been upgraded and the other has. (256-bit curve
keys work ok). In particular you may need to specify HostkeyAlgorithms
when connecting to a server that has not been upgraded from an upgraded
client.

ok naddy@

Implement Elliptic Curve Cryptography modes for key exchange (ECDH) and
host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer
better performance than plain DH and DSA at the same equivalent symmetric
key length, as well as much shorter keys.

Only the mandatory sections of RFC5656 are implemented, specifically the
three REQUIRED curves nistp256, nistp384 and nistp521 and only ECDH and
ECDSA. Point compression (optional in RFC5656 is NOT implemented).

Certificate host and user keys using the new ECDSA key types are supported.

Note that this code has not been tested for interoperability and may be
subject to change.

feedback and ok markus@

s/timing_safe_cmp/timingsafe_bcmp/g

implement a timing_safe_cmp() function to compare memory without leaking
timing information by short-circuiting like memcmp() and use it for
some of the more sensitive comparisons (though nothing high-value was
readily attackable anyway); "looks ok" markus@

Hold authentication debug messages until after successful authentication.
Fixes an info leak of environment variables specified in authorized_keys,
reported by Jacob Appelbaum.  ok djm@

Add support for certificate key types for users and hosts.

OpenSSH certificate key types are not X.509 certificates, but a much
simpler format that encodes a public key, identity information and
some validity constraints and signs it with a CA key. CA keys are
regular SSH keys. This certificate style avoids the attack surface
of X.509 certificates and is very easy to deploy.

Certified host keys allow automatic acceptance of new host keys
when a CA certificate is marked as trusted in ~/.ssh/known_hosts.
see VERIFYING HOST KEYS in ssh(1) for details.

Certified user keys allow authentication of users when the signing
CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS
FILE FORMAT" in sshd(8) for details.

Certificates are minted using ssh-keygen(1), documentation is in
the "CERTIFICATES" section of that manpage.

Documentation on the format of certificates is in the file
PROTOCOL.certkeys

feedback and ok markus@

Fix warnings found by chl@ and djm@ and change roaming_atomicio's
return type to match atomicio's
Diff from djm@, ok markus@

Keep track of number of bytes read and written. Needed for upcoming
changes. Most code from Martin Forssen, maf at appgate dot com.
ok markus@

Put the globals in packet.c into a struct and don't access it directly
from other files. No functional changes.
ok markus@ djm@

some paranoia: check that the serialised key is really KEY_RSA before
diddling its internals

Add support for an experimental zero-knowledge password authentication
method using the J-PAKE protocol described in F. Hao, P. Ryan,
"Password Authenticated Key Exchange by Juggling", 16th Workshop on
Security Protocols, Cambridge, April 2008.

This method allows password-based authentication without exposing
the password to the server. Instead, the client and server exchange
cryptographic proofs to demonstrate of knowledge of the password while
revealing nothing useful to an attacker or compromised endpoint.

This is experimental, work-in-progress code and is presently
compiled-time disabled (turn on -DJPAKE in Makefile.inc).

"just commit it.  It isn't too intrusive." deraadt@

sync v1 and v2 traffic accounting; add it to sshd, too; ok djm@, dtucker@

Make debug a little clearer.  ok djm@

Clear key options in the monitor on failed authentication, prevents
applying additional restrictions to non-pubkey authentications in
the case where pubkey fails but another method subsequently succeeds.
bz #1472, found by Colin Watson, ok markus@ djm@

Make the maximum number of sessions run-time controllable via
a sshd_config MaxSessions knob. This is useful for disabling
login/shell/subsystem access while leaving port-forwarding working
(MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or
simply increasing the number of allows multiplexed sessions.

Because some bozos are sure to configure MaxSessions in excess of the
number of available file descriptors in sshd (which, at peak, might be
as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds
on error paths, and make it fail gracefully on out-of-fd conditions -
sending channel errors instead of than exiting with fatal().

bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com

ok markus@

Implement a channel success/failure status confirmation callback
mechanism. Each channel maintains a queue of callbacks, which will
be drained in order (RFC4253 guarantees confirm messages are not
reordered within an channel).

Also includes a abandonment callback to clean up if a channel is
closed without sending confirmation messages. This probably
shouldn't happen in compliant implementations, but it could be
abused to leak memory.

ok markus@ (as part of a larger diff)

Send config block back to slave for invalid users too so options
set by a Match block (eg Banner) behave the same for non-existent
users.  Found by and ok djm@

unifdef -DBSD_AUTH
unifdef -USKEY

These options have been in use for some years;
ok markus@ "no objection" millert@

make file descriptor passing code return an error rather than call fatal()
when it encounters problems, and use this to make session multiplexing
masters survive slaves failing to pass all stdio FDs; ok markus@

pass received SIGINT from monitor to postauth child so it can clean
up properly. bz#1196, patch from senthilkumar_sen AT hotpop.com;
ok markus@

Teach Match how handle config directives that are used before authentication.
This allows configurations such as permitting password authentication from
the local net only while requiring pubkey from offsite.  ok djm@, man page
bits ok jmc@

upgrade to OpenSSH 4.5

upgrade to OpenSSH 4.5

upgrade to OpenSSH 4.5

correctly check for bad signatures in the monitor, otherwise the monitor and
the unpriv process can get out of sync. with dtucker@, ok djm@, dtucker@

upgrade to OpenSSH 4.4

upgrade to OpenSSH 4.4

Revert previous include file ordering change, for ssh to compile under gcc2
(or until openssl include files are cleaned of parameter names in function
prototypes)

"zlib.h" can be <zlib.h>; ok djm@ markus@

spaces

almost entirely get rid of the culture of ".h files that include .h files"
ok djm, sort of ok stevesk
makes the pain stop in one easy step

move #include <stdlib.h> out of includes.h

move #include <sys/param.h> out of includes.h

move #include <string.h> out of includes.h

move #include <errno.h> out of includes.h; ok markus@

move #include <fcntl.h> out of includes.h

missed these from last commit:
move #include <sys/socket.h> out of includes.h

move #include <pwd.h> out of includes.h; ok markus@

Prevent duplicate log messages when privsep=yes; ok djm@

Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
Theo nuked - our scripts to sync -portable need them in the files

introduce xcalloc() and xasprintf() failure-checked allocations functions
and use them throughout openssh

xcalloc is particularly important because malloc(nmemb * size) is a
dangerous idiom (subject to integer overflow) and it is time for it to
die

feedback and ok deraadt@

spacing

annoying spacing fixes getting in the way of real diffs

memory leaks detected by Coverity via elad AT netbsd.org;
deraadt@ ok

that should be all of them now

spacing

RCSID() can die

Implement the diffie-hellman-group-exchange-sha256 key exchange method
using the SHA256 code in libc (and wrapper to make it into an OpenSSL
EVP), interop tested against CVS PuTTY

move #include <signal.h> out of includes.h; ok markus@

move #include <sys/wait.h> out of includes.h; ok markus@

small KNF

move #include <paths.h> out of includes.h; ok markus@

upgrade to OpenSSH 4.3

upgrade to OpenSSH 4.3

KNF; ok djm@

upgrade to OpenSSH 4.1

spacing

upgrade to OpenSSH 4.0

upgrade to OpenSSH 4.0

Make code match intent; ok djm@

upgrade to OpenSSH 3.9

upgrade to OpenSSH 3.9

Move "Last logged in at.." message generation to the monitor, right
before recording the new login.  Fixes missing lastlog message when
/var/log/lastlog is not world-readable and incorrect datestamp when
multiple sessions are used (bz #463);  much assistance & ok markus@

Change login->username, will prevent -Wshadow errors in Portable; ok markus@

make ssh -Wshadow clean, no functional changes
markus@ ok

implement diffie-hellman-group14-sha1 kex method (trivial extension to
existing diffie-hellman-group1-sha1); ok markus@

improve some code lint did not like; djm millert ok

kill some more tiny files; ok deraadt@

upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8

upgrade to OpenSSH 3.8

Pass SIGALRM through to privsep child if LoginGraceTime expires.  ok markus@

unexpand and delete whitespace at EOL; ok markus@

unbreak fake authloop for non-existent users (my screwup). Spotted and
tested by dtucker@; ok markus@

replace "gssapi" with "gssapi-with-mic"; from Simon Wilkinson; test + ok jakob.

standardise arguments to auth methods - they should all take authctxt.
check authctxt->valid rather then pw != NULL; ok markus@

replace fatal_cleanup() and linked list of fatal callbacks with static
cleanup_exit() function.  re-refine cleanup_exit() where appropriate,
allocate sshd's authctxt eary to allow simpler cleanup in sshd.
tested by many, ok deraadt@

upgrade to OpenSSH 3.7

upgrade to OpenSSH 3.7

remove kerberos support from ssh1, since it has been replaced with GSSAPI;
but keep kerberos passwd auth for ssh1 and 2; ok djm, hin, henning, ...

fix passwd auth for 'username leaks via timing'; with djm@, original patches from solar

64 bit cleanups; markus ok

support GSS API user authentication; patches from Simon Wilkinson,
stripped down and tested by Jakob and myself.

remove (already disabled) KRB4/AFS support, re-enable -k in ssh(1);
test+ok henning@

int -> u_int; ok djm@, deraadt@, mouring@

typos; dtucker at zip.com.au

deprecate VerifyReverseMapping since it's dangerous if combined
with IP based access control as noted by Mike Harding; replace with
a UseDNS option, UseDNS is on by default and includes the
VerifyReverseMapping check; with itojun@, provos@, jakob@ and deraadt@
ok deraadt@, djm@

cast some types for printing; ok markus@

http://bugzilla.mindrot.org/show_bug.cgi?id=560
Privsep child continues to run after monitor killed.
Pass monitor signals through to child; Darren Tucker

implement kerberos over ssh2 ("kerberos-2@ssh.com"); tested with jakob@
server interops with commercial client; ok jakob@ djm@

rename log() into logit() to avoid name conflict.  markus ok, from netbsd

Update to OpenSSH 3.6.1

Merge OpenSSH 3.6.1

reapply rekeying chage, tested by henning@, ok djm@

backout rekeying changes (for 3.6.1)

rekeying bugfixes and automatic rekeying:

* both client and server rekey _automatically_
      (a) after 2^31 packets, because after 2^32 packets
          the sequence number for packets wraps
      (b) after 2^(blocksize_in_bits/4) blocks
  (see: http://www.ietf.org/internet-drafts/draft-ietf-secsh-newmodes-00.txt)
  (a) and (b) are _enabled_ by default, and only disabled for known
  openssh versions, that don't support rekeying properly.
* client option 'RekeyLimit'
* do not reply to requests during rekeying

Update to OpenSSH 3.6

unbreak rekeying for privsep; ok millert@

fix memory leaks; from dlheine@suif.Stanford.EDU/CLOUSEAU; ok djm@

fix permitrootlogin forced-commands-only for privsep; bux #387; ok provos@

skey/bsdauth: use 0 to indicate failure instead of -1, because
the buffer API only supports unsigned ints.

handle overflows for size_t larger than u_int; siw@goneko.de, bug #425

Update to OpenSSH 3.5

Update to OpenSSH 3.5

krb4 + privsep; ok dugsong@, deraadt@

only call kerberos code for authctxt->valid

only call auth_krb5 if kerberos is enabled; ok deraadt@

signed vs unsigned from -pedantic; ok henning@

kerberos support for privsep.  confirmed to work by lha@stacken.kth.se
patch from markus

pass addrlen with sockaddr *; from Hajimu UMEMOTO <ume@FreeBSD.org>
NOTE: there are also p-specific parts to this patch. ok markus@

Change mm_zalloc() sanity checks to be more in line with what
we do in calloc() and add a check to monitor_mm.c.
OK provos@ and markus@

u_int here; ok provos@

use xfree()

improve mm_zalloc check; markus ok

There was an update to OpenSSH 3.4, and people rejoiced.

Pull in OpenSSH-3.4

correct %u

be careful in mm_zalloc

save auth method before monitor_reset_key_state(); bugzilla bug #284;
ok provos@

Update OpenSSH to version 3.3 (with local changes, configuration files still
living in /etc and privsep user being nobody).

Don't initialise compression buffers when compression=no in sshd_config;
ok Niels@

make the monitor sync the transfer ssh1 session key;
transfer keycontext only for RC4 (this is still depends on EVP
implementation details and is broken).

__FUNCTION__ -> __func__

save the session id (hash) for ssh2 (it will be passed with the initial sign request)
and verify that this value is used during authentication; ok provos@

only allow enabled authentication methods; ok provos@

Upgrade to OpenSSH 3.2.3.

Except for improbable compilation error fixes, this should be the last
commit made to the 2.9-STABLE branche. Have fun upgrading.

Update to OpenSSH-3.2.3

Update to OpenSSH-3.2.2

Update OpenSSH to version 3.2.2.

'monitor' variable clashes with at least one lame platform (NeXT).  Renamed
to 'pmonitor'.  provos@

Fix sshd Banner option for privsep; ok markus@ provos@

check waitpid for EINTR; based on patch from peter@ifm.liu.se

monitor_allowed_key() returns int instead of pointer.  ok markus@

remove "\n" from fatal()

fix NULL %s on debug3(); ok markus@

use SSH_SESSION_KEY_LENGTH for key length

make getpwnamallow() allways call pwcopy()

whitespace KNF

clean up prototypes

implementation of the interface between privileged and unprivileged process
for ssh-privsep